Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

1
vote
3answers
218 views

Why do banks still hack-up autocomplete=off functionality?

With Bug #1025703 in the latest Firefox 38, Mozilla has finally decided to stand up for its users instead of catering to the banks that don't want the passwords remembered. However, I've noticed ...
4
votes
1answer
116 views

Re-display password in registration form good or bad?

When a user tries to register and the data he submits are not right such as bad email, or weak password, we would display the registration page again to him with the data he just submitted along with ...
3
votes
3answers
144 views

Would requiring multiple passwords enhance security?

I assume that it was considered at one point, and that there's a good reason for not doing it, I'm just curious as to why. I'm sure that there are many people who struggle to remember a single ...
5
votes
3answers
331 views

What steps can you take to make offline cracking of SRP harder?

In the aftermath of the Blizzard hack, what steps can I take to make offline cracking of SRP more difficult? My question assumes that your database is already gone and that you implemented SRP more ...
5
votes
5answers
3k views

Alternatives to sending out passwords in plain text via e-mail?

One of my hosting providers is sending a new password in plain text per e-mail, on request. How insecure is this practice? What would be a good (more secure) alternative to this?
6
votes
1answer
1k views

How does an attacker know when he has the password?

An attacker gets a list of hashed passwords. How does he know when he has cracked the password(s)? He can't try millions of times on the comprised account. Attacker gets hashed password. How does he ...
2
votes
1answer
1k views

How secure is automatic authentication in Skype?

How secure is checking the automatic authentication option in Skype client? What if I sign in with Microsoft account instead of Skype id? What if both accounts are merged? Is there any documentation ...
0
votes
1answer
323 views

How can American Express Serve login be PCI-DSS compliant?

Today I went to log into my American Express Serve account at https://secure.serve.com/ and accidentally discovered what appears to be a huge hole in their login process. Here are the steps involved: ...
1
vote
1answer
82 views

how to get cookies from aspx site to use it with hydra

I've been playing around with Hydra and .aspx site and I've hit a bit of a snag - Hydra responds letting me know that the first 16 passwords in my password list are correct when none of them are. ...
16
votes
2answers
9k views

Facebook API : App Secret - possible misuse

I've recently find out that by simple quick look into compiled code of one of our applications, you can get both App ID (API Key) and App Secret for Facebook API I suppose that we should really keep ...
9
votes
5answers
2k views

Gold Standard for password hashing

I've developing a web application that will be dealing with highly sensitive information and I want to ensure the hashing of passwords is gold standard. Ideally I'd go for per-user salted SHA512 ...
5
votes
3answers
172 views

Storing random initial (one-time) passwords in plain text

I manage a vendor app that issues accounts (with passwords, of course) to end users. From what I can see, final user passwords are stored properly. My concern is the initial account generation and ...
0
votes
1answer
45 views

QR-code based credential retrieval?

This is a sort of design review question that I'm hoping is suitable for this site. I am designing a system that uses a cloud service to establish a secure connection between a PC and a mobile ...
7
votes
4answers
703 views

Method to integrate Touch ID in iOS apps

With the recent announcement of Touch ID APIs for third party apps, I am wondering how can we leverage this feature to perform secure transaction ? I am looking for a method to use Touch ID in my ...
2
votes
2answers
124 views

Why is “\000” added to the end of passwords prior to hashing with bcrypt?

I am implementing bcrypt for java as found here. Before the actual hash takes place, line 455 of this implementation takes the raw String password, and transforms it into a byte array like so: ...
13
votes
4answers
1k views

Why will Google no longer allow me to end or begin passwords with a space? [closed]

Why won't Google allow me to use a password ending in a space anymore? Backstory: I have memorized a cipher that allows me to generate a different and very strong password across many different ...
13
votes
8answers
8k views

Are services like “LastPass” less secure, as they have all my passwords protected by a single password?

If the LastPass service has all my passwords and someone gets access to my LastPass password, this person will have access to all my passwords. Isn't that bad for security?
8
votes
3answers
2k views

How can I find if my password has been posted online?

I have just received this email from AbeBooks.com: Hello AbeBooks Customer, This is an important message from AbeBooks.com. As part of our routine security monitoring, we have learned ...
9
votes
7answers
29k views

Recommend Length for Wi-FI PSK?

I currently have a network set up with WPA2 and AES encryption, the password is 8 characters long but was randomly generated and contains no dictionary words. However I'm concerned about the ...
74
votes
9answers
11k views

New Gmail login system—going against conventional wisdom?

I noticed that the new gmail login asks for username first, and then confirms if such username exists, before asking for password input. Does this not go against conventional security wisdom to not ...
13
votes
3answers
2k views

Is it truly possible to store passwords securely, but be able to see the password?

Every place I looked, people recommended that storing passwords via encryption is like storing passwords in plain text. But every place I've looked, everyone recommends using a password manager like ...
6
votes
4answers
1k views

Store password using sha1 [duplicate]

I've been using the sha1() function to hash password before inserting it into my database. But I have this procedure so that it just won't be the password to be hashed. My page would register a user ...
18
votes
4answers
7k views

Deleting a Java Object securely

I know that in order to delete a Java object I should use character array instead of String, since I can safely erase (rewrite the character array with other data) its content. This seems not to be ...
26
votes
6answers
27k views

Most secure password hash algorithm(s)?

What is/are currently the most cryptographically secure hashing algorithm(s)? (available in PHP) Speed is irrelevant, because I'm iterating the hash over a fixed time (rather than a fixed number of ...
46
votes
6answers
7k views

How do some sites (e.g. online banks) only ask for specific characters from a password without storing it as plaintext?

I thought How can a system enforce a minimum number of changed characters... would answer my question, but it seems this is a different case. When I sign on to my online banking account, I'm prompted ...
4
votes
3answers
701 views

Which passwords to exclude from a password manager?

The benefits of a password manager are clear. Still, it seems that there might be a case to keep at least some passwords out of it: Your primary e-mail, to minimize the "single point of attack" ...
1
vote
1answer
96 views

How can one know if the password database on the server is stolen or not?

There are many password breaches happening now a days. How can the system administrator detect if the password database on the server is hacked? Obviously, the admin can know once the password ...
2
votes
3answers
139 views

Can I initially hash passwords with SHA instead of hashing them with bcrypt to decouple requests from slow crypto functions?

I'm using bcrypt for some web service requests that hash multiple passwords. The problem is that these web service requests can take minutes to complete due to bcrypt. Not very user friendly. My ...
1
vote
1answer
85 views

How is the username and password captured on this mobile device?

I have a Motorola phone, and I am concerned about my privacy after reading this article : http://www.beneaththewaves.net/Projects/Motorola_Is_Listening.html The poster says: For both of these ...
21
votes
6answers
2k views

Is there a use-case that renders the password manager obsolete?

Background Trevor posed a question about the nature and validity of using a password manager, given the current prevailing model of authentication on most web resources. Caveat: this is not the ...
1
vote
3answers
144 views

Will hashing passwords in my use case improve security and why?

I am developing an application the architecture of which is arranged as follows: Session host <---> Central relay server <---> Session client All communication between the initiating ...
13
votes
5answers
8k views

How can I avoid putting the database password in a perl script?

I have a cronned perl script that connects to our database and does various kinds of lookups and integrity checks. The original script was written by someone long ago. My job is to make some changes ...
21
votes
3answers
5k views

Security of LastPass + YubiKey

I'm looking at password manager solutions and came across LastPass. I see they also support two-factor authentication using YubiKeys. How secure is this combination for password management? What are ...
40
votes
9answers
11k views

How long should the password be?

The minimum password length recommended is about 8 characters, so is there any standard/recommended maximum length of the password?
2
votes
1answer
124 views

What is the best way to store passwords in OpenLDAP?

I would like to store user credentials in an OpenLDAP or similar directory server. A lot of online commentary about storing passwords in modern contexts recommends using password derivation schemes ...
16
votes
2answers
5k views

How big should salt be?

I will be using scrypt to store passwords in my application. As such, I'll be using SHA-256 and Salsa20 crypto primitives (with PBKDF2). Having that in mind, how big salt should I use? Should it be ...
25
votes
4answers
2k views

Why do some sites block pasting into username or password input fields?

I use a few websites that prevent me from copying & pasting into the username or password fields. It's quite frustrating when using a password manager, and if anything I'd think it discourages ...
30
votes
6answers
8k views

Length of passwords that are rainbow table safe

With large computing power (like what you can get in the Amazon cloud for example) you can generate huge rainbow tables for passwords. There also seems to be some large rainbow tables reachable that ...
2
votes
3answers
127 views

Is it safe to generate a password for a user during sign up in a web application?

I'm working on updating a web application. It currently creates a password for a user during sign up. Is asking the user to create the password themselves safer than relying on a generated password?
0
votes
1answer
32 views

Diceware & Database hosting [duplicate]

I'm currently setting up a new SQL database with DotEasy as my Hosting/Database provider. I've heard a lot about Diceware being one of the best methods of creating a really strong password, so I ...
11
votes
2answers
862 views

Should password reset tokens be hashed when stored in a database?

Passwords are hashed so that if someone gains access to a database of passwords then they won't know what the actual passwords are and so they can't log in. If I can get a valid password reset token ...
-6
votes
1answer
123 views

How to attack on a web page to gain username and password? [closed]

In a situation where a web page is not using SSL and someone wants to attack to gain the username and password. How it can be done? Given the situations: Passwords are not stored in plain text. ...
1
vote
4answers
1k views

RatticDB for passwords is not encrypted. Is this good approach?

I am looking for a password application for storing passwords, and RatticDB have a web interface and SSH access is planned, which are exactly the features I am looking for. However, they write that ...
6
votes
3answers
7k views

Is it safe to store password in HTML5 sessionStorage?

I am trying to improve the user experience on registration by not requiring the user to retype their password if validation on other fields fail. There are a few ways to implement this, example using ...
2
votes
2answers
93 views

How significant is the risk in having someone email/IM an htpasswd hash?

I need to set users up for subversion access, and we're currently stuck using htpasswd for our credential storage. If a user sends me an htpasswd record via email (or GChat / off the record?), what's ...
1
vote
0answers
149 views

Deobfuscated Malicious PHP Code Comprehensively [closed]

I found 3 php files in a htaccess-password-protected upload folder on my server: 1. default_folders.php 2. factory.php 3. HMAC.php Each of them contains a variable string, eg: ...
12
votes
7answers
2k views

Why don't we reward users who choose strong passwords? [closed]

Suppose there is a web property that has some sort of reward system or commodity that its users desire. It could be reputation on Stack Exchange-like sites, rank badges on message boards, or add-on ...
2
votes
2answers
74 views

Password strength with grouping of characters

For better readability and easier entry of long passwords I thought it was a good idea to group these using a fixed separator like so: f6hyF.75zaG.FhtYb.1a63h Assuming this structure of the ...
1
vote
2answers
359 views

What impact do the frequency of password resets have on password reuse?

Wondering if there's any research behind the most common password reset cycle I've seen of 90-days, and if there's any research that gives any insight into how to optimize password resets to reduce ...
0
votes
1answer
105 views

Free VPN and bank password security [closed]

For some odd reason my online banking fails when on mobile data. It works fine on wifi. In times past I used nokia's Xpress browser to route it through their servers but it is no longer available for ...